Fix security policy bot not allowed to run pipelines on GitLab.com

Behind the scan_execution_bot_users feature flag I added a feature that adds bot users to projects and then uses the bot user to trigger scheduled scan execution pipelines.

The bot user is added as Guest to the project but has some special permissions (added in !119136 (diffs)) to run pipelines.

This works as expected on staging and can be verified using the steps below. However it does not work on GitLab.com.

I was able to find logs for the failed pipeline creations. The logs show that the pipeline has a validation error:

You do not have sufficient permission to run a pipeline on 'test'. Please select a different branch or contact your administrator for assistance.

📺 Screenrecording: https://www.youtube.com/watch?v=r6hwlssRHaU

How to reproduce

1. Enable the scan_execution_bot_users feature flag. It is default enabled on staging and can be enabled for specific projects on GitLab.com
2. Prepare the test project. Follow the steps below or clone https://gitlab.com/gitlab-org/govern/security-policies/andys-test-group/scan-execution-policy-test
   1. Create a new project with a working .gitlab-ci.yml file. For example, use the bash template.
   2. Add an empty named package.json to the project. This is required for the SAST scan to run.
   3. On the left sidebar select Repository and Branches
   4. Select New branch
   5. Enter test as name
   6. Select Create branch
3. Prepare the security policy
   1. On the left sidebar, select Security and Compliance* and Policies.
   2. Select New policy.
   3. Select Scan execution policy
   4. Switch to .yaml mode
   5. Replace the content with the example policy yaml below
   6. Select Configure with a merge request
   7. Select Merge.
   8. Go back to your initial project
   9. There should now be a bot member named GitLab Security Policy Bot.
4. Wait for the next full hour until the scheduled pipeline is triggered.
5. View the pipelines page of your project
6. There should be a new pipeline triggered by the GitLab Security Policy Bot

Example policy yaml

type: scan_execution_policy
name: test
description: ''
enabled: true
rules:
  - type: schedule
    branches:
      - test
    cadence: 0 * * * *
actions:
  - scan: sast
    tags: []

Implementation plan

--- a/app/models/user.rb
+++ b/app/models/user.rb
@@ -2094,7 +2094,7 @@ def max_member_access_for_group(group_id)
   end
 
   def terms_accepted?
-    return true if project_bot?
+    return true if project_bot? || security_policy_bot?
 
     accepted_term_id.present?
   end